How it works
What DTrace answers
DTrace lets you ask targeted questions of a live system: who called a function, how often, how long it took, and which process or stack was responsible.
Probe description
The four components are provider:module:function:name. Wildcards allow broad matching. Use dtrace -l to discover probes available on this kernel.
D program structure
A probe description selects events, an optional /predicate/ filters them, and an action block performs tracing or aggregation.
Cost and safety
Broad tracing, string copying and stack capture can add overhead. Prefer aggregations and bounded durations; use narrow predicates and test before production.
Privileges
DTrace requires appropriate Solaris privileges. Security policy may restrict providers and actions; avoid granting full tracing rights casually.
Worked examples
Each example explains the question it answers, a reproducible starting point, what to look for, and operational precautions.
1. Explore available probes
Find real provider names before writing scripts.
dtrace -l | head -40
dtrace -l -P syscall
dtrace -l -n "syscall:::entry"Interpretation: Provider availability varies by Solaris release, platform and privilege.
Operational note: Run commands in a test environment first; confirm device names, privileges and release-specific options.
2. Trace a single syscall
See a simple probe fire.
dtrace -n "syscall::open*:entry { printf("%s pid=%d\n", execname, pid); }"Interpretation: You should see a process name and PID for matching calls.
Operational note: This can produce high event volume; stop with Ctrl-C.
3. Limit to one process
Avoid system-wide noise.
dtrace -n "syscall:::entry /pid == $target/ { @[probefunc] = count(); }" -p 1234Interpretation: Replace 1234 with the target PID; results appear when tracing stops.
Operational note: Run commands in a test environment first; confirm device names, privileges and release-specific options.
4. Understand basic D variables
Compare per-thread and aggregation storage.
syscall::read:entry { self->ts = timestamp; }
syscall::read:return /self->ts/ { @lat[execname] = avg(timestamp-self->ts); self->ts = 0; }Interpretation: Save as `readlat.d` and run `dtrace -s readlat.d`. `self->` is thread-local; `@` is an aggregation.
Operational note: Run commands in a test environment first; confirm device names, privileges and release-specific options.
Before you finish
- Always verify probe names on the target.
- Use bounded sampling windows and capture system baseline first.
Primary documentation
Read the relevant Oracle documentation for exact version-specific flags, supported platforms and limitations: Oracle primary reference ↗.
This field manual is independent, not affiliated with or endorsed by Oracle. Command examples should be adapted to your environment.